e0ab84a87ebf8da7f95654aa68ef47b5b2cf577c97add6cb18a653ad85522b68

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_58cc6651d883e4d1cc0abf16eab7d847_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 702KB
Sample260729-bkdk5adc85
SHA256 e0ab84a87ebf8da7f95654aa68ef47b5b2cf577c97add6cb18a653ad85522b68
MD5 58cc6651d883e4d1cc0abf16eab7d847
SHA1 8d74243366093efeb451b91aa7688b024892d3cf
SHA512 aa60f6261adc25ba9ac1b9aba30c9472d3e1bff5250acee1cea78b815f1927c21137bb1a6d0d3514941d4fb9482eb96f556a42880ed1c44fb482341d19cfa638
SSDEEP 12288:AnbcDwwYHTYUXzrWib7BO6uI2UffE/i15DmserLPhxJX3AaY9V8/KJLZmX1:AnDw+JuC76SE/i3u/3AaWeyLZmX1
TLSH
T17FE40242BAC040B5D8E22E329CB5561109BAFD6385F5EE4B33C83B013937D919725BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3640	5C4F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_58cc6651d883e4d1cc0abf16eab7d847_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C4F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3640	3828	2026-07-28_58cc6651d883e4d1cc0abf16eab7d847_elex_karagany_manuscrypt_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_58cc6651d883e4d1cc0abf16eab7d847_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_58cc6651d883e4d1cc0abf16eab7d847_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\5C4F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C4F.tmp
Size 702KB
SHA256 4837a4ee549e27e061fd4e84ee42ce046bb685d0269d6cc59029eb0925f42b2d
MD5 fa2ee017ec4f6eef069a0827fa910691
SHA1 77a40d4f5b6e3541b96b726068859c67c3a94375
SHA512 be530413657f186e811aafcf9f8fa00d9366dfbf2f258262b0c86a05a55a153992c9bf28ceb4da483ea64f5aeaa5c315f4afce8f4b81759e8d96a1a3f42c827b
SSDEEP 12288:AnbcDw1DtNGWIAlxTV4joQDpTiJm89i3iQ5YGiRw/rKJLZmX1:AnD1DtMWIAl1wTiJji31B/eLZmX1
TLSH
T1ABE4F141F9C040B4D0E16E368CB956020ABBFE1795E5AE5722C87B417833D529B39BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download